Critical DoS Vulnerability in FFmpeg Package: Resource Exhaustion via CINE File Processing
Summary
ALPINE-CVE-2017-14059: In FFmpeg 3.3.3, a DoS in cine_read_header() due to lack of an EOF check might cause huge CPU and memory consumption. Affects ffmpeg versions < 3.1.11-r0. Fixed in 3.1.11-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
FFmpeg is a widely-used open-source multimedia framework that enables users to record, convert, and stream audio and video. It supports a vast array of formats and codecs, making it a cornerstone in media processing applications. However, FFmpeg versions prior to the patched releases are susceptible to a denial-of-service (DoS) vulnerability that can lead to excessive CPU and memory consumption when processing specially crafted CINE files.
Vulnerability Detail
In FFmpeg version 3.3.3, a denial-of-service vulnerability exists in the cine_read_header() function due to the absence of an end-of-file (EOF) check. This flaw allows an attacker to create a malicious CINE file that claims a large 'duration' field in its header but lacks sufficient backing data. When such a file is processed, the image-offset parsing loop can enter an infinite cycle, consuming significant CPU and memory resources, potentially leading to system instability or crashes.
How To Fix
Minimum fixed version
3.1.11-r0
This is the first release that contains the fix.
sudo apk add --upgrade ffmpegTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can avoid processing untrusted CINE files until the package is updated to a secure version. Additionally, monitoring resource usage during file processing can help identify potential exploitation attempts.
Conclusion
The FFmpeg package has a critical denial-of-service vulnerability that can be exploited through specially crafted CINE files, leading to significant resource consumption. Users are strongly advised to update to the latest patched versions to safeguard their systems. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for ffmpeg →
FAQ
The CVSS score of this vulnerability is 6.5, indicating a medium severity level.
You can use Vulert, which allows you to monitor and alert for open-source vulnerabilities in your software using just a manifest file like package-lock.json. Visit the Vulert playground at Vulert Scanner to check for vulnerabilities without signing up.
FFmpeg versions prior to 3.1.11-r0 for Alpine v3.4 and v3.5, and prior to 3.2.8-r0 for Alpine v3.6, and prior to 3.3.4-r0 for Alpine v3.7 are affected.
The vulnerability can lead to denial-of-service conditions, causing excessive CPU and memory usage, which may result in system crashes or instability.
Yes, updating to the specified patched versions of FFmpeg is the permanent fix for this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for ffmpeg.
